The Department of Education is one of a number of federal agencies identified in years’ worth of inspector general reports as a cybersecurity risk, and one of only three departments to actually drop its percentage of users employing two-factor authentication during the White House’s post-Office of Personnel Management hack “Cyber Sprint” last summer.